@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/webhooks/webhooks.service.js

@@ -0,0 +1,238 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhooksService = void 0;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const auth_error_1 = require("../../common/auth-error.js");
+const encryption_service_1 = require("../../common/encryption.service.js");
+const network_safety_1 = require("../../common/network-safety.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const typeorm_row_1 = require("../../database/typeorm-row.js");
+const KNOWN_EVENT_NAMES = new Set(Object.values(constants_1.AUTH_EVENTS));
+/**
+ * Admin management of webhooks: URLs that receive auth events as signed HTTP POSTs.
+ * Deliveries themselves are sent by WebhookDeliveryWorker.
+ */
+let WebhooksService = class WebhooksService {
+    encryption;
+    database;
+    constructor(options, encryption) {
+        this.encryption = encryption;
+        this.database = options.dataSource;
+    }
+    /**
+     * Creates a webhook. Returns the signing secret ONCE: the receiver needs it to verify deliveries.
+     *
+     * @param input - URL, event names (empty = every event), description and on/off state.
+     * @returns The webhook and its plain signing secret.
+     * @throws AuthError UNSAFE_WEBHOOK_URL when the URL is not https or points at a private address.
+     * @throws AuthError VALIDATION_ERROR for unknown event names or too many webhooks.
+     */
+    async createWebhook(input) {
+        const webhooks = this.database.getRepository(entities_1.WebhookEntity);
+        if ((await webhooks.count()) >= constants_1.MAXIMUM_WEBHOOKS)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.validationFailed, { problems: [constants_1.VALIDATION_PROBLEM.tooManyWebhooks] });
+        await this.assertUrlIsSafe(input.url);
+        const eventNames = this.validateEventNames(input.eventNames ?? []);
+        const webhookId = (0, node_crypto_1.randomUUID)();
+        const signingSecret = this.createSigningSecret();
+        const savedWebhook = await webhooks.save({
+            id: webhookId,
+            url: input.url,
+            eventNames,
+            description: input.description ?? null,
+            isEnabled: input.isEnabled ?? true,
+            encryptedSigningSecret: await this.encryption.encrypt(signingSecret, this.encryptionContext(webhookId)),
+        });
+        return { success: true, webhook: this.toSummary(savedWebhook), signingSecret };
+    }
+    /**
+     * Lists every webhook, oldest first.
+     *
+     * @returns The webhooks, without their secrets.
+     */
+    async listWebhooks() {
+        const webhooks = await this.database.getRepository(entities_1.WebhookEntity).find({ order: { createdAt: constants_1.SORT_ORDER.oldestFirst } });
+        return webhooks.map((webhook) => this.toSummary(webhook));
+    }
+    /**
+     * Changes a webhook. Fields left undefined are not touched.
+     *
+     * @param webhookId - The webhook.
+     * @param changes - The fields to change.
+     * @returns The updated webhook.
+     * @throws AuthError NOT_FOUND when there is no such webhook.
+     * @throws AuthError UNSAFE_WEBHOOK_URL or VALIDATION_ERROR for a bad URL or event name.
+     */
+    async updateWebhook(webhookId, changes) {
+        const webhooks = this.database.getRepository(entities_1.WebhookEntity);
+        const webhook = await webhooks.findOne({ where: { id: webhookId } });
+        if (!webhook)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        if (changes.url !== undefined) {
+            await this.assertUrlIsSafe(changes.url);
+            webhook.url = changes.url;
+        }
+        if (changes.eventNames !== undefined)
+            webhook.eventNames = this.validateEventNames(changes.eventNames);
+        if (changes.description !== undefined)
+            webhook.description = changes.description;
+        if (changes.isEnabled !== undefined)
+            webhook.isEnabled = changes.isEnabled;
+        return { success: true, webhook: this.toSummary(await webhooks.save(webhook)) };
+    }
+    /**
+     * Deletes a webhook (its deliveries are deleted with it).
+     *
+     * @param webhookId - The webhook.
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when there is no such webhook.
+     */
+    async deleteWebhook(webhookId) {
+        const result = await this.database.getRepository(entities_1.WebhookEntity).delete({ id: webhookId });
+        if (!result.affected)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        return { success: true };
+    }
+    /**
+     * Replaces the signing secret (e.g. it leaked). The old one stops working at once.
+     *
+     * @param webhookId - The webhook.
+     * @returns The new plain signing secret, shown only this once.
+     * @throws AuthError NOT_FOUND when there is no such webhook.
+     */
+    async rotateSigningSecret(webhookId) {
+        const signingSecret = this.createSigningSecret();
+        const result = await this.database.getRepository(entities_1.WebhookEntity).update({ id: webhookId }, { encryptedSigningSecret: await this.encryption.encrypt(signingSecret, this.encryptionContext(webhookId)) });
+        if (!result.affected)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        return { success: true, signingSecret };
+    }
+    /**
+     * Recent deliveries of one webhook, newest first, for debugging a receiver.
+     *
+     * @param webhookId - The webhook.
+     * @param page - 1-based page number.
+     * @param pageSize - Rows per page (capped at MAXIMUM_PAGE_SIZE).
+     * @returns One page of deliveries, plus the total.
+     */
+    async listDeliveries(webhookId, page = 1, pageSize = constants_1.DEFAULT_PAGE_SIZE) {
+        const take = Math.min(Math.max(pageSize, 1), constants_1.MAXIMUM_PAGE_SIZE);
+        const [deliveries, total] = await this.database.getRepository(entities_1.WebhookDeliveryEntity).findAndCount({
+            where: { webhookId },
+            order: { createdAt: constants_1.SORT_ORDER.newestFirst },
+            skip: (Math.max(page, 1) - 1) * take,
+            take,
+        });
+        return { success: true, deliveries, total, page, pageSize: take };
+    }
+    /**
+     * Sends a failed (or any) delivery again, right away, with a fresh set of retries.
+     *
+     * @param webhookId - The webhook the delivery belongs to.
+     * @param deliveryId - The delivery.
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the delivery doesn't exist for this webhook.
+     */
+    async retryDelivery(webhookId, deliveryId) {
+        const result = await this.database
+            .getRepository(entities_1.WebhookDeliveryEntity)
+            .update({ id: deliveryId, webhookId }, { status: constants_1.WEBHOOK_DELIVERY_STATUS.pending, nextAttemptAt: new Date(), attemptCount: 0 });
+        if (!result.affected)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        return { success: true };
+    }
+    /**
+     * Queues a "webhook.test" delivery so the receiver can be checked end to end.
+     *
+     * @param webhookId - The webhook.
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when there is no such webhook.
+     */
+    async sendTestDelivery(webhookId) {
+        if (!(await this.database.getRepository(entities_1.WebhookEntity).exists({ where: { id: webhookId } })))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        await this.database.getRepository(entities_1.WebhookDeliveryEntity).insert((0, typeorm_row_1.typeormRow)({
+            webhookId,
+            eventName: constants_1.WEBHOOK_TEST_EVENT_NAME,
+            payload: { name: constants_1.WEBHOOK_TEST_EVENT_NAME, userId: null, data: { message: constants_1.WEBHOOK_TEST_MESSAGE }, occurredAt: new Date().toISOString() },
+            status: constants_1.WEBHOOK_DELIVERY_STATUS.pending,
+            nextAttemptAt: new Date(),
+        }));
+        return { success: true };
+    }
+    /**
+     * Reads a webhook's signing secret. Used by the delivery worker.
+     *
+     * @param webhook - The webhook row.
+     * @returns The plain signing secret.
+     */
+    decryptSigningSecret(webhook) {
+        return this.encryption.decrypt(webhook.encryptedSigningSecret, this.encryptionContext(webhook.id));
+    }
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @param url - The webhook URL.
+     * @throws AuthError UNSAFE_WEBHOOK_URL (with `problem`) when the server must not call it.
+     */
+    async assertUrlIsSafe(url) {
+        const problem = await (0, network_safety_1.findUrlSafetyProblem)(url);
+        if (problem)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.unsafeWebhookUrl, { problem });
+    }
+    /**
+     * @param eventNames - The event names the admin chose.
+     * @returns The names without duplicates.
+     * @throws AuthError VALIDATION_ERROR listing any names that are not real events.
+     */
+    validateEventNames(eventNames) {
+        const unknownNames = eventNames.filter((name) => !KNOWN_EVENT_NAMES.has(name));
+        if (unknownNames.length > 0) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.validationFailed, { problems: [constants_1.VALIDATION_PROBLEM.unknownEventNames(unknownNames)] });
+        }
+        return [...new Set(eventNames)];
+    }
+    /**
+     * @returns A new random signing secret like "whsec_...".
+     */
+    createSigningSecret() {
+        return `${constants_1.WEBHOOK_SECRET_PREFIX}${(0, node_crypto_1.randomBytes)(constants_1.WEBHOOK_SECRET_BYTES).toString(constants_1.TEXT_ENCODING.base64Url)}`;
+    }
+    /**
+     * Binds the encrypted secret to its webhook, so a secret copied to another row won't decrypt.
+     *
+     * @param webhookId - The webhook.
+     * @returns The context for `EncryptionService`.
+     */
+    encryptionContext(webhookId) {
+        return { purpose: constants_1.ENCRYPTION_PURPOSE.webhookSigningSecret, webhookId };
+    }
+    /**
+     * @param webhook - The webhook row.
+     * @returns The webhook without its encrypted secret, safe to show to admins.
+     */
+    toSummary(webhook) {
+        const { encryptedSigningSecret: _hiddenSecret, ...summary } = webhook;
+        return summary;
+    }
+};
+exports.WebhooksService = WebhooksService;
+exports.WebhooksService = WebhooksService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, encryption_service_1.EncryptionService])
+], WebhooksService);
+//# sourceMappingURL=webhooks.service.js.map

package/dist/features/webhooks/webhooks.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.service.js","sourceRoot":"","sources":["../../../src/features/webhooks/webhooks.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAsD;AAGtD,oDAAgD;AAChD,oEAAgE;AAChE,4DAA+D;AAC/D,2CAiBqB;AACrB,kDAA2E;AAC3E,wDAAoD;AAapD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,uBAAW,CAAC,CAAC,CAAC;AAEtE;;;GAGG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAKP;IAJF,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,UAA6B;QAA7B,eAAU,GAAV,UAAU,CAAmB;QAE9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,KAAmB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,4BAAgB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,8BAAkB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACxJ,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAEnE,MAAM,SAAS,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;YACvC,EAAE,EAAE,SAAS;YACb,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,UAAU;YACV,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,sBAAsB,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;SACxG,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,OAA8B;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAExD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACjF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACzC,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,MAAM,CACpE,EAAE,EAAE,EAAE,SAAS,EAAE,EACjB,EAAE,sBAAsB,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,CAC5G,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,aAAa,EAAE,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,IAAI,GAAG,CAAC,EAAE,QAAQ,GAAG,6BAAiB;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,6BAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,YAAY,CAAC;YAChG,KAAK,EAAE,EAAE,SAAS,EAAE;YACpB,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE;YAC5C,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI;YACpC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,UAAkB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;aAC/B,aAAa,CAAC,gCAAqB,CAAC;aACpC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,mCAAuB,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;QAClI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QACxI,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,MAAM,CAC7D,IAAA,wBAAU,EAAwB;YAChC,SAAS;YACT,SAAS,EAAE,mCAAuB;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,mCAAuB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,gCAAoB,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YACvI,MAAM,EAAE,mCAAuB,CAAC,OAAO;YACvC,aAAa,EAAE,IAAI,IAAI,EAAE;SAC1B,CAAC,CACH,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,OAAsB;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,8FAA8F;IAE9F;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,GAAW;QACvC,MAAM,OAAO,GAAG,MAAM,IAAA,qCAAoB,EAAC,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,UAAoB;QAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,8BAAkB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAoB,CAAC;IACrD,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,OAAO,GAAG,iCAAqB,GAAG,IAAA,yBAAW,EAAC,gCAAoB,CAAC,CAAC,QAAQ,CAAC,yBAAa,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,SAAiB;QACzC,OAAO,EAAE,OAAO,EAAE,8BAAkB,CAAC,oBAAoB,EAAE,SAAS,EAAE,CAAC;IACzE,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,OAAsB;QACtC,MAAM,EAAE,sBAAsB,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC;QACtE,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAxNY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACE,sCAAiB;GALrC,eAAe,CAwN3B"}

package/dist/guards/auth.decorators.d.ts

@@ -0,0 +1,65 @@
+import { AccessTokenClaims } from '../features/sessions/session.types.js';
+/**
+ * Who is calling the route. Exactly one of the two fields is set:
+ * - `user`: a person signed in with an access token.
+ * - `apiKey`: another server calling with an API key.
+ */
+export interface AuthenticatedCaller {
+    user?: AccessTokenClaims;
+    apiKey?: {
+        id: string;
+        name: string;
+        scopes: string[];
+        organizationId: string | null;
+    };
+}
+/**
+ * Anyone may call this route or controller, signed in or not.
+ *
+ * @returns A route or controller decorator.
+ */
+export declare const Public: () => import("@nestjs/common").CustomDecorator<"techelusive-auth:public-route">;
+/**
+ * Only users with at least one of these roles may call the route.
+ *
+ * @param roleNames - The roles that are allowed.
+ * @returns A route or controller decorator.
+ * @example
+ * @Roles('seller', 'admin')
+ */
+export declare const Roles: (...roleNames: string[]) => import("@nestjs/common").CustomDecorator<"techelusive-auth:required-roles">;
+/**
+ * Only admins may call the route. Which roles count as "admin" comes from the settings
+ * (admin.adminRoles), so it can be changed at runtime. Also checks that the session is still active.
+ *
+ * @returns A route or controller decorator.
+ */
+export declare const AdminOnly: () => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;
+/**
+ * Before running the route, confirm in the database that the session has not been signed out
+ * and the account is still ACTIVE. Use it on sensitive routes (payments, changing email, admin work).
+ * Without it, a signed-out token keeps working until it expires (a few minutes).
+ *
+ * @returns A route or controller decorator.
+ */
+export declare const CheckSession: () => import("@nestjs/common").CustomDecorator<"techelusive-auth:check-session">;
+/**
+ * Lets servers call the route with an API key that has ALL of these scopes.
+ * Signed-in users may still call it as normal.
+ *
+ * @param scopes - The scopes the key must have.
+ * @returns A route or controller decorator.
+ * @example
+ * @ApiKeyScopes('rides:read')
+ */
+export declare const ApiKeyScopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<"techelusive-auth:api-key-scopes">;
+/**
+ * Controller parameter: the signed-in user's token claims.
+ *   @Get('profile') getProfile(@CurrentUser() user: AccessTokenClaims) { ... }
+ *   @Get('id') getId(@CurrentUser('sub') userId: string) { ... }
+ */
+export declare const CurrentUser: (...dataOrPipes: (keyof AccessTokenClaims | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>> | undefined)[]) => ParameterDecorator;
+/** Controller parameter: the signed-in user's id (the token's "sub" claim). */
+export declare const CurrentUserId: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/** Controller parameter: the full caller (user or API key). Useful on routes that accept both. */
+export declare const CurrentCaller: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/guards/auth.decorators.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentCaller = exports.CurrentUserId = exports.CurrentUser = exports.ApiKeyScopes = exports.CheckSession = exports.AdminOnly = exports.Roles = exports.Public = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../constants.js");
+/**
+ * Anyone may call this route or controller, signed in or not.
+ *
+ * @returns A route or controller decorator.
+ */
+const Public = () => (0, common_1.SetMetadata)(constants_1.METADATA_KEY.publicRoute, true);
+exports.Public = Public;
+/**
+ * Only users with at least one of these roles may call the route.
+ *
+ * @param roleNames - The roles that are allowed.
+ * @returns A route or controller decorator.
+ * @example
+ * @Roles('seller', 'admin')
+ */
+const Roles = (...roleNames) => (0, common_1.SetMetadata)(constants_1.METADATA_KEY.requiredRoles, roleNames);
+exports.Roles = Roles;
+/**
+ * Only admins may call the route. Which roles count as "admin" comes from the settings
+ * (admin.adminRoles), so it can be changed at runtime. Also checks that the session is still active.
+ *
+ * @returns A route or controller decorator.
+ */
+const AdminOnly = () => (0, common_1.applyDecorators)((0, common_1.SetMetadata)(constants_1.METADATA_KEY.adminOnly, true), (0, exports.CheckSession)());
+exports.AdminOnly = AdminOnly;
+/**
+ * Before running the route, confirm in the database that the session has not been signed out
+ * and the account is still ACTIVE. Use it on sensitive routes (payments, changing email, admin work).
+ * Without it, a signed-out token keeps working until it expires (a few minutes).
+ *
+ * @returns A route or controller decorator.
+ */
+const CheckSession = () => (0, common_1.SetMetadata)(constants_1.METADATA_KEY.checkSessionInDatabase, true);
+exports.CheckSession = CheckSession;
+/**
+ * Lets servers call the route with an API key that has ALL of these scopes.
+ * Signed-in users may still call it as normal.
+ *
+ * @param scopes - The scopes the key must have.
+ * @returns A route or controller decorator.
+ * @example
+ * @ApiKeyScopes('rides:read')
+ */
+const ApiKeyScopes = (...scopes) => (0, common_1.SetMetadata)(constants_1.METADATA_KEY.apiKeyScopes, scopes);
+exports.ApiKeyScopes = ApiKeyScopes;
+/**
+ * Controller parameter: the signed-in user's token claims.
+ *   @Get('profile') getProfile(@CurrentUser() user: AccessTokenClaims) { ... }
+ *   @Get('id') getId(@CurrentUser('sub') userId: string) { ... }
+ */
+exports.CurrentUser = (0, common_1.createParamDecorator)((claimName, executionContext) => {
+    const caller = executionContext.switchToHttp().getRequest()[constants_1.CALLER_REQUEST_PROPERTY];
+    const user = caller?.user;
+    return claimName ? user?.[claimName] : user;
+});
+/** Controller parameter: the signed-in user's id (the token's "sub" claim). */
+exports.CurrentUserId = (0, common_1.createParamDecorator)((_unused, executionContext) => {
+    const caller = executionContext.switchToHttp().getRequest()[constants_1.CALLER_REQUEST_PROPERTY];
+    return caller?.user?.sub;
+});
+/** Controller parameter: the full caller (user or API key). Useful on routes that accept both. */
+exports.CurrentCaller = (0, common_1.createParamDecorator)((_unused, executionContext) => executionContext.switchToHttp().getRequest()[constants_1.CALLER_REQUEST_PROPERTY]);
+//# sourceMappingURL=auth.decorators.js.map

package/dist/guards/auth.decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.decorators.js","sourceRoot":"","sources":["../../src/guards/auth.decorators.ts"],"names":[],"mappings":";;;AAAA,2CAAsG;AACtG,2CAAoE;AAapE;;;;GAIG;AACI,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAA3D,QAAA,MAAM,UAAqD;AAExE;;;;;;;GAOG;AACI,MAAM,KAAK,GAAG,CAAC,GAAG,SAAmB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAY,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAAvF,QAAA,KAAK,SAAkF;AAEpG;;;;;GAKG;AACI,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAA,wBAAe,EAAC,IAAA,oBAAW,EAAC,wBAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAA,oBAAY,GAAE,CAAC,CAAC;AAA7F,QAAA,SAAS,aAAoF;AAE1G;;;;;;GAMG;AACI,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;AAA5E,QAAA,YAAY,gBAAgE;AAEzF;;;;;;;;GAQG;AACI,MAAM,YAAY,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAAvF,QAAA,YAAY,gBAA2E;AAEpG;;;;GAIG;AACU,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAAC,SAA8C,EAAE,gBAAkC,EAAE,EAAE;IACrF,MAAM,MAAM,GAAoC,gBAAgB,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC,mCAAuB,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC,CACF,CAAC;AAEF,+EAA+E;AAClE,QAAA,aAAa,GAAG,IAAA,6BAAoB,EAAC,CAAC,OAAgB,EAAE,gBAAkC,EAAsB,EAAE;IAC7H,MAAM,MAAM,GAAoC,gBAAgB,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC,mCAAuB,CAAC,CAAC;IACtH,OAAO,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,kGAAkG;AACrF,QAAA,aAAa,GAAG,IAAA,6BAAoB,EAC/C,CAAC,OAAgB,EAAE,gBAAkC,EAAmC,EAAE,CACxF,gBAAgB,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC,mCAAuB,CAAC,CACxE,CAAC"}

package/dist/guards/auth.guard.d.ts

@@ -0,0 +1,47 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { ApiKeysService } from '../features/api-keys/api-keys.service.js';
+import { SessionService } from '../features/sessions/session.service.js';
+import { SettingsService } from '../features/settings/settings.service.js';
+/**
+ * Runs before every route (when installed as the app-wide guard) and decides who may call it.
+ *
+ * Checks, in this order:
+ * - @Public() routes let everyone in (a token is still read if sent, so @CurrentUser() works
+ *   on public routes too).
+ * - An "x-api-key" header on a route marked @ApiKeyScopes(): the key and its scopes are checked.
+ * - Otherwise an "Authorization: Bearer <access token>" header is required.
+ * - @CheckSession() / @AdminOnly(): the database confirms the session is still active.
+ * - @Roles() / @AdminOnly(): the user needs one of the roles.
+ */
+export declare class AuthGuard implements CanActivate {
+    private readonly reflector;
+    private readonly sessions;
+    private readonly apiKeys;
+    private readonly settings;
+    constructor(reflector: Reflector, sessions: SessionService, apiKeys: ApiKeysService, settings: SettingsService);
+    /**
+     * Decides whether the request may reach the route (see the class comment for the order of checks).
+     * On success, the caller is attached to the request for @CurrentUser() and friends.
+     *
+     * @param executionContext - Nest's view of the current request.
+     * @returns True when the request may continue.
+     * @throws AuthError UNAUTHORIZED when no access token was sent.
+     * @throws AuthError INVALID_TOKEN when the token is bad, or the session has ended (on checked routes).
+     * @throws AuthError INVALID_API_KEY or FORBIDDEN for a bad API key or a missing scope.
+     * @throws AuthError FORBIDDEN when the user lacks a required role.
+     */
+    canActivate(executionContext: ExecutionContext): Promise<boolean>;
+    /**
+     * @param authorizationHeader - The Authorization header.
+     * @returns The token from "Bearer <token>", or undefined.
+     */
+    private readBearerToken;
+    /**
+     * Stores who is calling on the request, for the @CurrentUser(), @CurrentUserId() and @CurrentCaller() decorators.
+     *
+     * @param request - The HTTP request.
+     * @param caller - The signed-in user or the API key.
+     */
+    private attachCaller;
+}

package/dist/guards/auth.guard.js

@@ -0,0 +1,132 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const auth_error_1 = require("../common/auth-error.js");
+const constants_1 = require("../constants.js");
+const api_keys_service_1 = require("../features/api-keys/api-keys.service.js");
+const session_service_1 = require("../features/sessions/session.service.js");
+const settings_service_1 = require("../features/settings/settings.service.js");
+/**
+ * Runs before every route (when installed as the app-wide guard) and decides who may call it.
+ *
+ * Checks, in this order:
+ * - @Public() routes let everyone in (a token is still read if sent, so @CurrentUser() works
+ *   on public routes too).
+ * - An "x-api-key" header on a route marked @ApiKeyScopes(): the key and its scopes are checked.
+ * - Otherwise an "Authorization: Bearer <access token>" header is required.
+ * - @CheckSession() / @AdminOnly(): the database confirms the session is still active.
+ * - @Roles() / @AdminOnly(): the user needs one of the roles.
+ */
+let AuthGuard = class AuthGuard {
+    reflector;
+    sessions;
+    apiKeys;
+    settings;
+    constructor(reflector, sessions, apiKeys, settings) {
+        this.reflector = reflector;
+        this.sessions = sessions;
+        this.apiKeys = apiKeys;
+        this.settings = settings;
+    }
+    /**
+     * Decides whether the request may reach the route (see the class comment for the order of checks).
+     * On success, the caller is attached to the request for @CurrentUser() and friends.
+     *
+     * @param executionContext - Nest's view of the current request.
+     * @returns True when the request may continue.
+     * @throws AuthError UNAUTHORIZED when no access token was sent.
+     * @throws AuthError INVALID_TOKEN when the token is bad, or the session has ended (on checked routes).
+     * @throws AuthError INVALID_API_KEY or FORBIDDEN for a bad API key or a missing scope.
+     * @throws AuthError FORBIDDEN when the user lacks a required role.
+     */
+    async canActivate(executionContext) {
+        if (executionContext.getType() !== constants_1.HTTP_CONTEXT_TYPE)
+            return true;
+        const request = executionContext.switchToHttp().getRequest();
+        const readMetadata = (key) => this.reflector.getAllAndOverride(key, [executionContext.getHandler(), executionContext.getClass()]);
+        const isPublicRoute = readMetadata(constants_1.METADATA_KEY.publicRoute) === true;
+        const requiredApiKeyScopes = readMetadata(constants_1.METADATA_KEY.apiKeyScopes);
+        const presentedApiKey = request.headers?.[constants_1.API_KEY_HEADER];
+        const presentedAccessToken = this.readBearerToken(request.headers?.[constants_1.HTTP_HEADER.authorization]);
+        // Public route: a token is optional, and a bad one is simply ignored.
+        if (isPublicRoute) {
+            if (presentedAccessToken) {
+                const claims = await this.sessions.verifyAccessToken(presentedAccessToken).catch(() => undefined);
+                if (claims)
+                    this.attachCaller(request, { user: claims });
+            }
+            return true;
+        }
+        // Server-to-server call with an API key.
+        if (presentedApiKey !== undefined && requiredApiKeyScopes) {
+            const apiKey = await this.apiKeys.verifyApiKey(presentedApiKey);
+            const hasEveryScope = requiredApiKeyScopes.every((scope) => apiKey.scopes.includes(scope));
+            if (!hasEveryScope)
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.missingApiKeyScope);
+            this.attachCaller(request, {
+                apiKey: { id: apiKey.id, name: apiKey.name, scopes: apiKey.scopes, organizationId: apiKey.organizationId },
+            });
+            return true;
+        }
+        // Everything else needs a signed-in user.
+        if (!presentedAccessToken)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.unauthorized);
+        const claims = await this.sessions.verifyAccessToken(presentedAccessToken);
+        // Optional live check that the session and account are still active.
+        const isAdminOnlyRoute = readMetadata(constants_1.METADATA_KEY.adminOnly) === true;
+        const mustCheckSession = isAdminOnlyRoute || readMetadata(constants_1.METADATA_KEY.checkSessionInDatabase) === true;
+        if (mustCheckSession && !(await this.sessions.isSessionStillAllowed(claims.sid, claims.sub))) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidAccessToken);
+        }
+        // Roles.
+        const requiredRoles = readMetadata(constants_1.METADATA_KEY.requiredRoles) ?? [];
+        if (requiredRoles.length > 0 && !requiredRoles.some((role) => claims.roles.includes(role))) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.forbidden);
+        }
+        if (isAdminOnlyRoute) {
+            const { adminRoles } = (await this.settings.getSettings()).admin;
+            if (!adminRoles.some((role) => claims.roles.includes(role)))
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.forbidden);
+        }
+        this.attachCaller(request, { user: claims });
+        return true;
+    }
+    /**
+     * @param authorizationHeader - The Authorization header.
+     * @returns The token from "Bearer <token>", or undefined.
+     */
+    readBearerToken(authorizationHeader) {
+        if (typeof authorizationHeader !== 'string')
+            return undefined;
+        return constants_1.BEARER_TOKEN_PATTERN.exec(authorizationHeader)?.[1];
+    }
+    /**
+     * Stores who is calling on the request, for the @CurrentUser(), @CurrentUserId() and @CurrentCaller() decorators.
+     *
+     * @param request - The HTTP request.
+     * @param caller - The signed-in user or the API key.
+     */
+    attachCaller(request, caller) {
+        request[constants_1.CALLER_REQUEST_PROPERTY] = caller;
+    }
+};
+exports.AuthGuard = AuthGuard;
+exports.AuthGuard = AuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        session_service_1.SessionService,
+        api_keys_service_1.ApiKeysService,
+        settings_service_1.SettingsService])
+], AuthGuard);
+//# sourceMappingURL=auth.guard.js.map

package/dist/guards/auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../src/guards/auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA2E;AAC3E,uCAAyC;AACzC,oDAAgD;AAChD,2CAQqB;AACrB,2EAAsE;AACtE,yEAAqE;AACrE,2EAAuE;AAGvE;;;;;;;;;;GAUG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAED;IACA;IACA;IACA;IAJnB,YACmB,SAAoB,EACpB,QAAwB,EACxB,OAAuB,EACvB,QAAyB;QAHzB,cAAS,GAAT,SAAS,CAAW;QACpB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAiB;IACzC,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAClD,IAAI,gBAAgB,CAAC,OAAO,EAAE,KAAK,6BAAiB;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAC7D,MAAM,YAAY,GAAG,CAAI,GAAW,EAAE,EAAE,CACtC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAgB,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAErH,MAAM,aAAa,GAAG,YAAY,CAAU,wBAAY,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;QAC/E,MAAM,oBAAoB,GAAG,YAAY,CAAW,wBAAY,CAAC,YAAY,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,0BAAc,CAAC,CAAC;QAC1D,MAAM,oBAAoB,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC,CAAC;QAEhG,sEAAsE;QACtE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClG,IAAI,MAAM;oBAAE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yCAAyC;QACzC,IAAI,eAAe,KAAK,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YAChE,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,CAAC,CAAC;YACxE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;gBACzB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;aAC3G,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC,oBAAoB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;QAE3E,qEAAqE;QACrE,MAAM,gBAAgB,GAAG,YAAY,CAAU,wBAAY,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;QAChF,MAAM,gBAAgB,GAAG,gBAAgB,IAAI,YAAY,CAAU,wBAAY,CAAC,sBAAsB,CAAC,KAAK,IAAI,CAAC;QACjH,IAAI,gBAAgB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;QAED,SAAS;QACT,MAAM,aAAa,GAAG,YAAY,CAAW,wBAAY,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAC/E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,SAAS,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,mBAA4B;QAClD,IAAI,OAAO,mBAAmB,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9D,OAAO,gCAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,OAAgC,EAAE,MAA2B;QAChF,OAAO,CAAC,mCAAuB,CAAC,GAAG,MAAM,CAAC;IAC5C,CAAC;CACF,CAAA;AA7FY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;qCAGmB,gBAAS;QACV,gCAAc;QACf,iCAAc;QACb,kCAAe;GALjC,SAAS,CA6FrB"}

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @techelusive/nest-auth: reusable authentication for NestJS apps.
+ * Everything an app needs is exported from here.
+ */
+export { AuthModule } from './auth.module';
+export type { AuthEmail, AuthEvent, AuthModuleConfig, AuthOptions, EmailSender, EncryptionOptions, PasskeyOptions, SmsSender, } from './auth-options';
+export { AuthGuard } from './guards/auth.guard';
+export { AdminOnly, ApiKeyScopes, CheckSession, CurrentCaller, CurrentUser, CurrentUserId, Public, Roles, } from './guards/auth.decorators';
+export type { AuthenticatedCaller } from './guards/auth.decorators';
+export { CurrentRequest, SYSTEM_REQUEST } from './common/request-context';
+export type { RequestContext } from './common/request-context';
+export * from './database/entities';
+export { AUTH_MIGRATIONS, CreateAuthTables1792600000000 } from './database/create-auth-tables.migration';
+export { EmailChangeAndRetention1792700000000 } from './database/email-change-and-retention.migration';
+export { UsersService } from './features/users/users.service';
+export { DataRetentionService } from './features/maintenance/data-retention.service';
+export type { DataRetentionReport } from './features/maintenance/data-retention.service';
+export { SessionService } from './features/sessions/session.service';
+export { SignInService } from './features/sign-in/sign-in.service';
+export { SettingsService } from './features/settings/settings.service';
+export { AuthEventsService } from './features/events/auth-events.service';
+export { ApiKeysService } from './features/api-keys/api-keys.service';
+export { OrganizationsService } from './features/organizations/organizations.service';
+export { TwoFactorService } from './features/two-factor/two-factor.service';
+export { SigningKeysService } from './features/signing-keys/signing-keys.service';
+export { WebhooksService } from './features/webhooks/webhooks.service';
+export type { AccessTokenClaims, SignInMethod, TokenSet } from './features/sessions/session.types';
+export type { SignInResult, SignedInResult, TwoFactorRequiredResult } from './features/sign-in/sign-in.types';
+export type { PendingVerification, PublicUserProfile } from './features/users/users.types';
+export type { AuthSettings, SettingsChanges } from './features/settings/settings.types';
+export { DEFAULT_SETTINGS } from './features/settings/settings.defaults';
+export { AuthError } from './common/auth-error';
+export { ACCOUNT_STATUS, ACCOUNT_STATUSES, AUTH_ERRORS, AUTH_EVENTS, ORGANIZATION_ROLE, ORGANIZATION_ROLES, PENDING_VERIFICATION, ROUTES, SIGN_IN_METHOD, SIGN_IN_STATUS, SOCIAL_PROVIDER, } from './constants';
+export type { AccountStatus, AuthErrorDefinition, AuthErrorName, AuthEventName, OrganizationRole, SocialProvider } from './constants';
+export { Msg91SmsSender } from './integrations/msg91-sms-sender';
+export type { Msg91Options } from './integrations/msg91-sms-sender';
+export { ConsoleEmailSender } from './integrations/console-email-sender';
+export { verifyWebhookSignature } from './features/webhooks/webhook-signature';